Accountabilities:

Monitor Microsoft Defender: Continuously monitor Microsoft Defender portals, security dashboards, alert queues, and incident notifications to identify potential security threats and endpoint protection issues.
Perform initial alert triage: Review malware detections, suspicious activities, and endpoint security alerts, assessing device information, severity levels, timestamps, and potential business impact.
Validate endpoint protection: Perform basic checks on Defender sensor health, endpoint onboarding status, protection configurations, and security coverage.
Identify security vulnerabilities and issues: Detect endpoints with failed scans, outdated security intelligence, inactive sensors, or other protection-related problems and report them through established procedures.
Escalate potential threats: Identify suspicious activities and high-severity alerts and escalate them promptly to L2/L3 analysts and relevant security teams according to established escalation procedures.
Manage security incidents: Create, categorize, prioritize, and update incident tickets using ServiceNow or equivalent IT Service Management platforms.
Collect investigation evidence: Gather and document relevant alert information, device details, timestamps, and initial investigation findings to support further analysis.
Execute security runbooks: Perform approved first-level investigation and validation activities by following documented security procedures and operational guidelines.
Coordinate incident resolution: Track open incidents and collaborate with L2/L3 analysts, SOC teams, and endpoint specialists throughout investigation and remediation activities.
Validate remediation activities: Confirm endpoint protection recovery and remediation status as instructed by senior security teams, ensuring incidents are accurately updated.
Follow security procedures: Respect established authorization boundaries and escalation protocols, avoiding unauthorized containment or remediation actions.
Maintain operational compliance: Follow security incident management, incident, change, and service request processes while ensuring timely alert acknowledgement and SLA compliance.
Document operational activities: Maintain accurate incident records, operational checklists, investigation notes, and shift handover documentation.
Collaborate across teams: Coordinate with SOC, Endpoint, Identity, Infrastructure, and L2/L3 teams to support effective security operations.
Support reporting and improvement: Contribute to routine security reports, alert tracking, and operational reviews while identifying recurring alerts and reporting monitoring or documentation gaps.
Ensure global monitoring continuity: Facilitate effective handovers across APAC, EMEA, and North America teams to maintain uninterrupted 24/7 security monitoring.

Requirements

Professional experience: 1–3 years of experience in IT operations, security monitoring, endpoint support, or security incident management.
Endpoint security knowledge: Basic understanding of endpoint protection technologies, antivirus solutions, malware detection, and common security alerts.
Microsoft Defender expertise: Familiarity with Microsoft Defender for Endpoint or equivalent endpoint protection platforms. Practical experience with Microsoft Defender is highly desirable.
Windows operating systems: Basic knowledge of Windows environments, system processes, endpoint health, and troubleshooting fundamentals.
Security alert investigation: Ability to review security alerts, identify relevant information, collect evidence, and follow documented investigation procedures.
Incident management: Understanding of incident severity levels, escalation matrices, response procedures, and SLA requirements.
ITSM tools: Familiarity with ServiceNow or equivalent IT Service Management platforms for incident logging, tracking, and documentation.
Communication skills: Good written and verbal communication abilities, with the capacity to provide clear investigation updates and accurate shift handovers.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1